Events can be monitored in a distributed arrangement of devices that can be coupled over one or multiple networks. The events are represented by data collected by various sources in the distributed arrangement of electronic devices. The monitored events can be analyzed for various purposes. As an example, the events can be analyzed to identify an attack on a network or an electronic device, such that real-time countermeasures can be invoked to thwart the attack or mitigate the damage caused by the attack.